Rate session fixation and hijacking risk from identifier regeneration, entropy, transport acceptance, binding and timeout policy.
Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly. If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.
Session Fixation Risk
Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score).
Attacker window
usable window = min(idle timeout, absolute lifetime), the minutes a stolen identifier stays valid.
Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score). Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly.
If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.
This calculator takes 7 inputs: Session identifier regeneration at login, Where session identifiers are accepted from, Session identifier entropy, Binding to client context, Idle timeout, Absolute session lifetime, Privilege carried by the session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It helps but it is not free. Mobile users change address constantly and corporate NAT puts thousands of users behind one address, so IP binding causes false logouts while barely inconveniencing an attacker on the same network. Prefer regeneration, short timeouts and a stable device signal.